Analyze volatile memory dumps using Volatility 3 to extract running processes, network connections, loaded modules, and evidence of malicious activity.
Analyze volatile memory dumps using Volatility 3 to extract running processes, network connections, loaded modules, and evidence of malicious activity.
When analyzing a RAM dump from a compromised or suspect system
During incident response to identify running malware, injected code, or rootkits
When you need to extract credentials, encryption keys, or network connections from memory
For detecting process hollowing, DLL injection, or hidden processes
When disk-based forensics alone is insufficient and volatile data is critical
Detection Gaps & Validation
Volatility output is only as good as the symbols and the plugins you remember to run. Avoid these failure modes:
Wrong symbols/profile = empty or misleading output. If windows.info/banners can't match a kernel or plugins return zero rows, you have the wrong ISF/symbol pack, not a clean image. Confirm the exact build (e.g., 19041) and fetch matching symbols before concluding "no processes/connections found." A Linux dump needs a banner-matched ISF built from the target kernel's System.map/DWARF.
Acquisition smear and partial dumps. RAM captured from a live, running system is inconsistent across the acquisition window (page smear); pointers may be stale and structures torn. Note acquisition method/time, and treat single-plugin results as candidates to corroborate.
Hidden artifacts need cross-view, not one list.pslist (EPROCESS list) misses unlinked/DKOM-hidden processes — diff against psscan (pool scan). Same for modules vs modscan, and netstat vs netscan. A process in psscan but not pslist, or malfind hits with RWX private memory, are the real leads.
Validate before reporting. Confirm injection by dumping the region (windows.vadinfo/memmap --dump) and checking for PE headers/shellcode, then YARA-scan it; correlate netscan C2 IPs with cmdline, loaded DLLs, and disk/network logs. Extract suspected malware and detonate or hash-match — don't call a malfind hit "Cobalt Strike" on permissions alone.
Interpretation false positives.malfind flags legitimate JIT engines (.NET, browsers, Java) with RWX memory; many svcscan/netscan entries are benign. LISTENING sockets and residual /stale connections are not active C2. hashdump/lsadump can return blanks on modern Credential-Guard systems — absence isn't proof creds weren't stolen.
Information that exists only in RAM and is lost when power is removed
Process hollowing
Technique where malware replaces legitimate process memory with malicious code
DLL injection
Loading unauthorized DLLs into a running process address space
EPROCESS
Windows kernel structure representing a process; basis for process listing
Pool scanning
Searching memory for kernel object signatures to find hidden artifacts
VAD (Virtual Address Descriptor)
Memory management structure tracking process virtual memory regions
ISF (Intermediate Symbol Format)
Volatility 3 symbol table format for OS-specific structure definitions
Malfind
Plugin detecting injected code by examining VAD permissions and content
Tools & Systems
Tool
Purpose
Volatility 3
Primary open-source memory forensics framework
LiME
Linux Memory Extractor for acquiring Linux RAM dumps
WinPmem
Windows physical memory acquisition driver
DumpIt
Comae one-click Windows memory dump utility
YARA
Pattern matching engine for malware signature scanning
Rekall
Alternative memory forensics framework (Google)
MemProcFS
Memory process file system for memory analysis
strings
Extract printable strings from binary memory dumps
Common Scenarios
Scenario 1: Active Malware Investigation
Acquire memory with DumpIt, run pslist/pstree to identify suspicious processes, use malfind to detect injected code in svchost.exe, dump the injected memory segment, scan with YARA rules identifying Cobalt Strike beacon, extract C2 IP from netscan, correlate with network logs.
Scenario 2: Credential Theft After Breach
Run hashdump and lsadump to extract cached credentials, identify mimikatz execution in cmdline output, check for lsass.exe memory dumps in filesystem artifacts, correlate with lateral movement evidence in network connections.
Scenario 3: Rootkit Detection
Compare pslist (uses EPROCESS linked list) with psscan (pool scanning) to find unlinked processes, check modules vs modscan for hidden kernel drivers, examine SSDT for hooks redirecting system calls, dump suspicious modules for static analysis.
Scenario 4: Ransomware Incident Recovery
Extract encryption keys from ransomware process memory before system shutdown, identify the ransomware variant using YARA, find the initial execution point through command line artifacts, map lateral movement via network connections.
